Review gag clauses in patient agreements: the CRFA

Some patient paperwork still carries a line like “Patient agrees not to post negative comments about the practice online,” or “Any review that damages the practice’s reputation will result in a $500 administrative fee.” Others are quieter: a membership agreement that gives the practice copyright in anything the member writes about it, or an online booking checkbox that says reviews must be sent to the office first. These clauses are usually copied from an old template, and nobody remembers adding them.

Since 2017, a federal law has made clauses like these void in standard consumer contracts and made offering them unlawful. This guide reads the Consumer Review Fairness Act, 15 U.S.C. 45b, and the FTC’s business guidance on it, and applies them to the forms a dental office, med spa, chiropractic or integrative clinic hands patients. It also covers what the law still lets a practice do, which is more than people expect. For what to write when a negative review does appear, see patient review replies and HIPAA and negative review replies. For the terms page on your website, see medical website disclaimers and terms of use.

This is general information, not legal advice. Sources cited were checked on November 1, 2026: 15 U.S.C. 45b (the Consumer Review Fairness Act) and 15 U.S.C. 45(m)(1)(A) in the Cornell LII text of the U.S. Code; the FTC business guidance Consumer Review Fairness Act: What Businesses Need to Know (dated February 2017), read from an archived copy captured October 23, 2026, because ftc.gov does not load from our server; and 16 CFR 465.7, 16 CFR 1.98 and 45 CFR 164.502(a) in the eCFR version up to date as of October 29, 2026. How the Act applies to a particular health form is our reading, not FTC text. State law may also apply, and section 45b(g) leaves state causes of action in place; we did not read state rules for this guide. Have a health care attorney review your patient forms.

The short version

Review bans in standard patient forms are void. Under 15 U.S.C. 45b(b)(1), a form contract provision is void from the start if it prohibits or restricts a patient’s review, imposes a penalty or fee for one, or takes the patient’s intellectual property rights in the review beyond a non-exclusive license.
Offering the clause is itself unlawful. Section 45b(c) makes it unlawful to offer a form contract that contains such a provision, whether or not the practice ever enforces it.
“Review” is broad. The Act covers written, oral or pictorial reviews and assessments of goods, services or conduct. The FTC guidance lists online reviews, social media posts, photos and videos, and evaluations of customer service.
The FTC and state attorneys general enforce it. A violation is treated as a violation of an FTC trade regulation rule, which opens the door to civil penalties.
Some limits survive. The Act does not affect duties of confidentiality imposed by law, defamation claims, or a site owner’s right to remove certain content from its own website.
Separately, the FTC’s reviews rule bars threats. 16 CFR 465.7 prohibits groundless legal threats, intimidation and knowingly false public accusations used to stop or remove a review.

What the law covers

The Act turns on two defined terms. A form contract, under 45b(a)(3), is a contract with standardized terms used by a business in selling or leasing its goods or services and imposed on an individual without a meaningful opportunity to negotiate those terms. Employment and independent contractor contracts are excluded. A covered communication, under 45b(a)(2), is a written, oral or pictorial review, performance assessment or similar analysis, including by electronic means, of the goods, services or conduct of a business, made by an individual who is a party to a form contract with that business. Pictorial includes pictures, photographs, video, illustrations and symbols.

A typical new patient packet reads like the first definition: the same packet goes to every new patient, and the financial policy is not negotiated at the front desk. The FTC guidance gives the online version of the same idea: a company may not put a provision in its terms and conditions that prohibits or punishes negative reviews by customers.

Section 45b(b)(1) then voids three kinds of provisions in those contracts:

Prohibits or restricts a review. A ban on negative reviews, a requirement to get approval before posting, a rule that reviews may only go to the practice privately, or a “non-disparagement” clause in a standard patient agreement.
Imposes a penalty or fee for a review. An “administrative fee,” loss of a discount, cancellation of a membership or a charge for “reputation management” triggered by a post.
Takes the patient’s IP rights in the review. A clause assigning copyright in any review to the practice. The Act allows only a non-exclusive license to use the content.

The FTC guidance adds a point practices often miss: remove the provision even if you have never tried to enforce it or have no intention of enforcing it. Section 45b(c) makes offering the contract the violation.

Where these clauses hide in a practice

A review clause is rarely in a document called “review policy.” These are the places to check:

New patient intake packets and the signature page at the end.
Financial policies and payment plan agreements.
Membership plan agreements and auto-renewal terms. See membership auto-renewal rules.
Treatment consent forms for elective procedures, especially in aesthetics, where some templates add “confidentiality” lines about results.
Photo and testimonial consent forms. See patient photo consent for marketing.
Online booking and intake form checkboxes. See online patient intake forms.
Website terms of use that patients agree to when they book or pay online.
Discount, package and deposit terms. See booking deposits and cancellation fees.

What a practice may still do

The Act is narrower than “anything goes.” Section 45b(b)(2) says the voiding rule does not affect:

Any duty of confidentiality imposed by law, including agency guidance.
Any civil claim for defamation, libel, slander or a similar cause of action.
A party’s right to remove or refuse to display, on a website it owns or controls, review content that contains another person’s personal information or likeness; is libelous, harassing, abusive, obscene, vulgar or sexually explicit; is inappropriate with respect to race, gender, sexuality, ethnicity or another intrinsic characteristic; is unrelated to the goods or services offered there; or is clearly false or misleading.

Section 45b(b)(3) adds exceptions for provisions that prohibit disclosure of, or reserve a host’s right to remove, trade secrets and confidential commercial or financial information; personnel and medical files and similar information whose disclosure would be a clearly unwarranted invasion of personal privacy; certain law enforcement records; unlawful content; and content with viruses or other damaging code.

So a practice can moderate testimonials and comments on its own website under a written, even-handed policy, and can ask that nobody post another patient’s health information. It cannot use those exceptions to keep an unhappy patient quiet. The FTC guidance says plainly that a consumer’s assessment or opinion you disagree with is unlikely to meet the “clearly false or misleading” standard.

One more limit runs the other way. The exceptions do not let a practice take a review down from Google, Yelp or a social platform; that depends on each platform’s own policies. On your own site, our guide to blog comments on a practice website covers moderation.

Confidentiality is a duty on the practice, not a gag on the patient

Under the HIPAA Privacy Rule, 45 CFR 164.502(a), a covered entity or business associate may not use or disclose protected health information except as the rule permits or requires. The rule is written for those entities; it is not a limit on what a patient says about their own care. The “duty of confidentiality imposed by law” carve-out in 45b(b)(2)(A) protects legal confidentiality duties; it is not a reason to add a clause telling patients not to discuss their treatment publicly.

The practical effect for a practice is a mismatch: a patient can describe their visit in detail, and the practice usually cannot answer with any detail at all. That is the reason reply templates matter. Our HIPAA review replies guide reads the HHS Office for Civil Rights cases where practice replies went wrong.

Threats and pressure after a review: the FTC reviews rule

The Consumer Review Fairness Act deals with contract terms. The FTC’s Rule on the Use of Consumer Reviews and Testimonials deals with conduct. Under 16 CFR 465.7(a), it is an unfair or deceptive act or practice for anyone to use an unfounded or groundless legal threat, a physical threat, intimidation, or a public false accusation made with knowledge or reckless disregard of its falsity, in an attempt to prevent a review or to get one removed.

Section 465.7(b) covers a business’s own review display: it may not misrepresent that the reviews shown on its site represent most or all of the reviews submitted when it is suppressing reviews based on their rating or negative sentiment. Withholding reviews under criteria applied equally to all reviews, such as defamatory content, another person’s personal information, reviews the seller reasonably believes are fake, or reviews unrelated to its services, is not treated as suppression based on sentiment.

For a practice, that rules out a demand letter threatening suit over an honest one-star review, a call telling a patient their account will go to collections unless the review comes down, and a public reply calling a real patient a fake. It also rules out a testimonials page that silently drops every critical review while presenting itself as the full set. For review requests and incentives, see patient review replies and patient testimonials and before-and-after photos.

Enforcement and penalties

Under 45b(d), offering a form contract with a void provision is treated as a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the FTC Act. Under 45b(e), a state attorney general, or another state consumer protection officer authorized by the state, may bring a civil action in federal court on behalf of state residents, after notifying the FTC.

Rule violations matter because of 15 U.S.C. 45(m)(1)(A), which allows the FTC to seek a civil penalty from a person who violates a trade regulation rule with actual knowledge, or knowledge fairly implied from objective circumstances, that the act is unfair or deceptive and prohibited by the rule. The statute sets the amount at not more than $10,000 for each violation. That figure is adjusted for inflation every year; 16 CFR 1.98(d) lists $53,088 per violation for penalties assessed after January 17, 2025. The FTC guidance summarizes the risk as financial penalties and a federal court order.

The Act took effect on December 14, 2016. Under 45b(i), subsections (b) and (c) apply to contracts in effect on or after the date 90 days later, and the enforcement subsections (d) and (e) apply to contracts in effect on or after the date one year later. A clause still sitting in a form signed today is covered.

A clause-by-clause check for your forms

Collect every form a patient signs or clicks. Paper packets, PDFs on the website, online booking terms, membership and payment plan agreements, consent forms and any vendor-hosted forms used in your name.
Search for the words. Review, post, online, social media, comment, disparage, defame, reputation, feedback, testimonial, confidential, copyright, intellectual property.
Classify each hit. Does it restrict a review, charge for one, or take rights in one? If yes, it falls under 45b(b)(1) unless an exception applies.
Check the exceptions narrowly. Moderation of your own website under 45b(b)(2)(C), and a ban on posting other people’s medical information under 45b(b)(3)(B), are allowed. A ban on criticism is not.
Rewrite or remove. Replace with a neutral line, such as an invitation to contact the practice manager with concerns, that does not make the review conditional on anything.
Check the website. Terms of use, testimonial page and review widgets: is any filtering applied evenly, and does the page claim to show all reviews?
Write down the review response rule for staff. No threats, no collections pressure, no public accusations, no patient details. Route anything that looks like a legal issue to the owner and counsel.
Date the change. Keep the old and new versions with the date the new one went into use, with your advertising records.

Use and avoid

Use: “If you have a concern about your care, please contact our practice manager at the number below. We read every message.” Avoid: “Patient agrees to resolve all concerns privately before posting any online review.”
Use: “On our website we do not publish comments that include another person’s health information or that are abusive or unrelated to our services.” Avoid: “The practice may remove any review it considers harmful to its reputation.”
Use: “By submitting a testimonial you give us a non-exclusive license to display it.” Avoid: “All reviews and feedback become the property of the practice.”
Use: a written policy that applies the same moderation criteria to positive and negative comments. Avoid: hiding critical reviews while labelling the page “What all our patients say.”
Use: a reply that thanks the reviewer and invites them to call, without patient details. Avoid: a letter from a lawyer over an honest, unflattering review.

An illustration

This is a made-up example, not a client. A med spa’s membership agreement, copied from a template years ago, includes: “Member agrees not to make disparaging statements about the spa on any website or social media. Violation results in immediate termination of membership without refund.” The agreement is presented on a tablet at check-in and members tap to accept.

The agreement uses standardized terms, is used in selling the spa’s services and is imposed without a meaningful chance to negotiate, so it is a form contract under 45b(a)(3). The clause restricts reviews and attaches a penalty, so it is void under 45b(b)(1)(A) and (B), and offering it is unlawful under 45b(c), whether or not the spa has ever terminated anyone. The fix is to remove the clause from the tablet version and the PDF, note the date, and, if the spa wants a moderation policy for its own website, write one that fits 45b(b)(2)(C).

How we help

We review the patient-facing pages and forms we build for independent practices, including booking terms and intake flows on practice websites, and we set up review request processes for local search that do not filter or pressure patients. We also run lead generation and Google Ads campaigns and an AI front desk that routes complaints to a person. We are not a law firm and we do not give legal or medical advice. Related guides: Yelp for medical practices, dark patterns on healthcare websites and our guide to healthcare marketing rules.

Can a practice ask patients not to post negative reviews in its intake forms?

Not in a standard form. Under 15 U.S.C. 45b(b)(1), a form contract provision that prohibits or restricts a review, or imposes a penalty or fee for one, is void, and 45b(c) makes it unlawful to offer a form contract containing it.

Is an old clause a problem if we never enforce it?

Yes. The violation in 45b(c) is offering the form contract with the provision. The FTC’s business guidance says to remove such provisions even if you have never tried to enforce them or have no intention of doing so.

Can we remove reviews from our own website?

Section 45b(b)(2)(C) preserves a site owner’s right to remove or not display content that contains another person’s personal information, is libelous, harassing, abusive, obscene, vulgar or sexually explicit, is discriminatory, is unrelated to your services, or is clearly false or misleading. The FTC guidance says an opinion you disagree with is unlikely to be clearly false or misleading.

Does HIPAA let us require patients to keep their treatment confidential?

The Privacy Rule, 45 CFR 164.502(a), limits uses and disclosures by covered entities and business associates, not what patients say about their own care. The Act’s carve-out in 45b(b)(2)(A) protects confidentiality duties imposed by law; it does not authorize a gag on the patient.

Does the Act apply to staff agreements?

No. Section 45b(a)(3)(B) excludes employer-employee and independent contractor contracts from the definition of form contract. Other law may apply to those agreements; this guide does not cover it.

Can we threaten legal action over a false review?

The Act does not affect defamation claims under 45b(b)(2)(B). But 16 CFR 465.7(a) makes it unfair or deceptive to use an unfounded or groundless legal threat, intimidation or a knowingly false public accusation to prevent or remove a review. Talk to a lawyer before contacting a reviewer about legal action.

Gag clauses and review bans in patient agreements